CVE-2025-27914

published 2025-03-12

CVE-2025-27914: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest…

Priority P4 24 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token and involves a crafted URL with manipulated query parameters that triggers XSS when accessed by a victim.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
zimbra	collaboration	—	—
zimbra	collaboration	—	—
zimbra	collaboration	>= 10.0.0 < 10.0.11	10.0.11

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79